CVE-2025-37995

Source
https://nvd.nist.gov/vuln/detail/CVE-2025-37995
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-37995.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-37995
Downstream
Related
Published
2025-05-29T14:15:36Z
Modified
2025-08-13T00:00:22Z
Summary
[none]
Details

In the Linux kernel, the following vulnerability has been resolved:

module: ensure that kobject_put() is safe for module type kobjects

In 'lookuporcreatemodulekobject()', an internal kobject is created using 'modulektype'. So call to 'kobjectput()' on error handling path causes an attempt to use an uninitialized completion pointer in 'modulekobjectrelease()'. In this scenario, we just want to release kobject without an extra synchronization required for a regular module unloading process, so adding an extra check whether 'complete()' is actually required makes 'kobject_put()' safe.

References

Affected packages